Electron up to 38.8.5/39.8.0/40.7.x on Windows powerMonitor use after free

Summaryinfo

A vulnerability was found in Electron up to 38.8.5/39.8.0/40.7.x on Windows. It has been classified as critical. This issue affects some unknown processing of the component powerMonitor Module. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-34770. The attack requires a local approach. No exploit exists. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Electron up to 38.8.5/39.8.0/40.7.x on Windows. It has been classified as critical. This affects an unknown code block of the component powerMonitor Module. The manipulation with an unknown input leads to a use after free vulnerability. CWE is classifying the issue as CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, apps that use the powerMonitor module may be vulnerable to a use-after-free. After the native PowerMonitor object is garbage-collected, the associated OS-level resources (a message window on Windows, a shutdown handler on macOS) retain dangling references. A subsequent session-change event (Windows) or system shutdown (macOS) dereferences freed memory, which may lead to a crash or memory corruption. All apps that access powerMonitor events (suspend, resume, lock-screen, etc.) are potentially affected. The issue is not directly renderer-controllable. This issue has been patched in versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-34770 since 03/30/2026. The exploitability is told to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 38.8.6, 39.8.1, 40.8.0 or 41.0.0-beta.8 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• Electron

Version

• 38.8.0
• 38.8.1
• 38.8.2
• 38.8.3
• 38.8.4
• 38.8.5
• 39.0
• 39.1
• 39.2
• 39.3
• 39.4
• 39.5
• 39.6
• 39.7
• 39.8.0
• 40.0
• 40.1
• 40.2
• 40.3
• 40.4
• 40.5
• 40.6
• 40.7

Website

• Product: https://github.com/electron/electron/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion